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(57) Abstract: A portable data carrier comprises a memory with a biometric template which is intended to be compared with a 
biometric sample for identity check. The biometric template is divided into a private part which is adapted to be exclusively used in 
the portable data carrier and a public part which is adapted to be transferred to and used in an externa! processing unit. Moreover, 
a processing unit for use in biometric identity check is described. The processing unit is adapted to receive a biometric sample 
and a public part of a biometric template, compare the received public part of the template with the biometric sample, and when a 
comparison criterion has been satisfied, transfer at least part of the biometric sample to the portable data carrier for further comparison 
in the data carrier with a private part of the template. A method for recording a biometric template and a biometric identity check is 
also described. 
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BIOMETRIC IDENTITY CHECK 

Related Applications 

This application claims priority from Swedish Patent 
Application No. SE 0001576-8 and US Provisional Patent 
Application No. 60/210,635. 
5 Field of the Invention 

The present invention relates to a portable data 
carrier which comprises a memory with a biometric tem- 
plate which is intended to be compared with a biometric 
sample for identity check. The invention further relates 
10 to a processing unit, a computer program product and 

various methods which are intended for use in connection 
with biometric checking of identity. 
Background of the Invention 

The access to information, to a room or the like 
15 must in many cases be restricted to certain individuals. 
This is the case, for instance, when electronic money 
transactions occur via the Internet, when in a hospital 
• the access to case records is to be limited, or when only 
certain individuals in a place of work are allowed to 

2 0 have access to certain information or certain rooms. 

To this end, use is often made of what is referred 
to as intelligent cards or smart cards. A smart card can 
be described as a card in the size of an account card 
which has a built-in processor, a memory and some kind 
25 of communication interface, which in its simplest form 
may consist of one or more metal contacts. 

Also so-called hardware tokens work essentially 
according to the same principle as smart cards . They 
are typically used in a computer as a key to "unlock 11 

3 0 the computer and give a user access to information. The 

difference compared with a smart card is more of a prac- 
tical type since a hardware token can be directly insert- 
ed into the USB or serial port of a computer while a 
smart card must be placed in a special smart cart reader 
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which is connected to or incorporated in the computer. 
For this reason, also the software on the hardware token 
differs somewhat from the software on smart cards, but 
their purpose is essentially the same. 
5 On all smart cards that are used in the above con- 

texts, sensitive information is stored in the memory. 
A first part of the sensitive information is reference 
information stored in advance about the user of the card. 
It is with this reference information that a comparison 

10 is made every time the card user wishes to verify his 
right to use the card. 

Smart cards also contain a second part of sensitive 
information which consists of computer files which only 
the card user may access. They may contain, for example, 

15 computer files with private encryption keys, longer pass- 
words or other information that can be used to identify 
the user. When the card user wants to verify that he has 
the right to access to the sensitive information stored 
in the computer files on the smart card, he places the 

2 0 card in a smart card reader and enters a pin code (PIN = 

Personal Identification Number) . The pin code is limited 
to 16 bytes and usually consists of four digits between 
zero and nine which are matched with a reference pin code 
stored on the card. If the pin code corresponds with the 
25 reference, "the card is unlocked", i.e. the user gains 
access to the computer files containing the sensitive 
information. Pin codes are presently used in many situa- 
tions, and many people find it difficult to remember a 
number of different pin codes. Therefore, many people 

3 0 choose to use the same pin code in a number of different 

situations, thus deteriorating security. 

For this reason, and with a view to further 
increasing security, alternative solutions have been 
presented, in which a user instead identifies himself 
3 5 with the aid of biometric information. By biometric 

information is meant information which is body-related 
and individual-specific for the user. It may consist of, 
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for instance, the pattern of the user's fingers, palm, 
iris, or some other information which is not related 
to appearance but yet individual -specif ic, such as the 
user's voice. A method in which a user identifies himself 
5 with the aid of his fingerprint typically proceeds as 
follows : 

The user places his smart card in a smart card 
reader and one finger on a sensor which generates a 
digital image, i.e. a digital representation, of the 

10 fingerprint. The digital image of the fingerprint pro- 
ceeds to an external processor, for instance a personal 
computer, where it is preprocessed. In the preprocess- 
ing, the amount of information in the image is reduced 
so that, for instance, a binarised image or parts of a 

15 binarised image are generated. A corresponding prepro- 
cessed image has been stored on the card as reference 
information. This reference information is usually refer- 
red to as a template. The external processor collects the 
template from the card and compares this with the prepro- 

2 0 cessed image of the finger. In case of correspondence-, 

the external processor transmits a pin code to the card. 
This pin code acts as a key and gives access to the sen- 
sitive information stored in the memory of the card. If 
the template and the preprocessed image information do 

25 not correspond with each other, no pin code is transmit- 
ted and the user cannot access the computer files with 
the sensitive information on the card. 

Even if biometry is used so that the user will not 
need to use a pin code, a pin code is still transmitted 

30 at the last stage of the verification process since this 
pin code is necessary for the "unlocking" of specific 
files containing sensitive information on the smart card. 
Thus the pin code must be hardcoded either in the soft- 
ware for the application which communicates with the 

3 5 card, or in some hardware in the unit where the card is 

read and written. Consequently no significant increase 
of the security is achieved despite the use of biometry 
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since there is still a risk that someone may access the 
computer files with sensitive information on the card by- 
transmitting the pin code to the card. 

A further problem is that the template with which 
5 the matching occurs must be read from the card into the 
external processor in which the comparison with the 
user's biometric data takes place. In the first place 
this is a security risk, and in the second place there 
are directives issued by computer security authorities 

10 in certain countries which recommend that a biometric 
template should never leave the smart card. 

One solution to the above problems is presented in 
Swedish Patent No. 8101707-1 which discloses an account 
card type data carrier which is provided with verifi- 

15 cation equipment comprising a sensor on which a user 

places one of his fingers. The sensor records papillary 
line information from the user's finger and calculates 
an identification bit sequence which is compared with 
a previously stored reference bit sequence. If the bit 

20 sequences conform with each other, an acceptance signal 
is generated, which can activate an indication means or 
a connecting means which makes the data carrier useable. 

Although this solution eliminates the use of pin 
codes and lets the template remain on the card all the 

25 time, certain drawbacks still remain. For instance, the 
card cannot be a standard type smart card since such a 
card has no sensor and also does not have sufficient 
processor capacity to carry out the proposed method. 
Summary of the Invention 

30 An object of the present invention therefore is to 

obviate, or at least alleviate, the above problems and to 
provide an alternative solution for biometric checking of 
identity, which solution has a high degree of security 
but yet allows use of e.g. a standard type smart card 

35 with limited processing capacity. 

According to the invention, this object is achieved 
by a portable data carrier according to claim 1, a method 
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for biometric checking of identity according to claim 15, 
a computer program product according to claim 22, a pro- 
cessing unit according to claim 24, a method for produc- 
ing a biometric template according to claim 28, a compu- 
5 ter program product according to claim 35, a method for 
biometric checking of identity according to claim 36, a 
computer product according to claim 41 and use of a bio- 
metric template according to claim 42 . 

More specifically, the invention concerns a portable 

10 data carrier, comprising a memory with a biometric tem- 
plate which is intended to be compared with a biometric 
sample for identity check. The biometric template is 
divided into a private part which is adapted to be exclu- 
sively used in the portable data carrier and a public 

15 part which is adapted to be transferred to an external 
processing unit and be used in the same. 

By portable data carrier is meant a number of dif- 
ferent portable units, such as smart cards, hardware 
tokens, MultiMedia Cards (MMC) etc, which all have the 

2 0 feature in common that they have a safe memory area which 

can be used for biometric checking of identity, i.e. for 
checking that a biometric template and a later recorded 
biometric sample originate from the same person. 

By the expressions biometric template and biometric 
25 sample are meant data that is unique to an individual. 

Examples of such data can be the pattern of the person's 
fingers, palm, iris, or the person's voice. The template 
relates to reference information which is stored on the 
data carrier, whereas the sample relates to biometric 

3 0 data which must be presented by a person on each occasion 

of checking his or hers identity. 

The fact that the template is divided into a private 
and a public part means that a certain part of the tem- 
plate never leaves the data carrier and that this part 
35 is thus not accessible to an unauthorised person, which 

results in significantly increased security compared with 
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the case where the entire template is read from the data 
carrier and compared with a sample in an external unit . 

The public part, however, is intended to be trans- 
ferred to the external processing unit and to be used 
5 only in the same. This makes it possible to carry out 

some processor- demanding processing in the external pro- 
cessing unit so that less processing capacity in the data 
carrier is required, thus making it possible to use, for 
example, standard type smart cards. 

10 Moreover a possibility of utilising different secu- 

rity levels for different applications is created since 
it is possible either to merely make a first comparison 
between the public part of the template and the biometric 
sample in the external processing unit or, in addition, 

15 to make a comparison in the data carrier between the pri- 
vate part of the template and the biometric sample . 

This means that first a check of the biometric 
sample is made in the processing unit, and if this check 
satisfies a predetermined comparison criterion, one or 

2 0 more parts of the biometric sample are transferred to the 
data carrier for a final check in the same . By the final 
identity check being made on the data carrier, no pin 
code need be generated in the processing unit and trans- 
ferred to the data carrier. Instead one or more parts of 

2 5 the biometric sample are transferred, which is much more 

difficult to fake since it is much more complex than a 
common pin code. Security also increases still more since 
it is impossible for an ill-intentioned person to steel 
or copy the entire template from the processing unit 

3 0 since only part thereof leaves the data carrier to be 

used in the first comparison in the processing unit. 

According to a preferred embodiment, the private 
part of the biometric template comprises at least one 
partial area, which constitutes a private partial area, 
35 of a digital image of an individual -specif ic parameter. 

Preferably a plurality of private partial areas are used. 
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Thus the private partial area is a subset of a digi- 
tal image. The use of a partial area of an image in a 
biometric template is advantageous since a suitably 
selected partial area contains much information which 
5 can be used in the identity check. One or more suitably 
selected partial areas, e.g. fingerprint partial areas 
with special line formations, may result in almost the 
same good security as if a complete image of the indivi- 
dual-specific parameter is used while at the same time 

10 the amount of information used in the comparison has been 
reduced to a considerable extent. It goes without saying 
that more partial areas result in greater security, but 
on the other hand greater processing capacity of the data 
carrier is necessary. 

15 The digital image can be made by means of thermal 

technique, optical technique, capacitive technique or 
some other convenient technique. It may be processed 
after the actual recording, for instance binarised. 

The individual -specific parameter can be, for exam- 

20 pie, the pattern of a person's iris or retina, a hand- 
print of some other individual -specif ic parameter which 
can be reproduced. However, it is preferably a finger- 
print . This enables a simple recording process where 
conventional sensors can be used and the individual can 

25 easily provide the biometric template. 

In a preferred embodiment, the public part of the 
biometric template comprises information which is intend- 
ed to be used for determining a reference point in the 
biometric sample, which reference point corresponds to 

3 0 a reference point in the biometric template. 

As a result, it is possible to determine how the 
biometric sample is translated in relation to the bio- 
metric sample, which makes it possible to select areas 
of the biometric sample which correspond to the private 

35 partial area or areas. 

In a preferred embodiment, the public part of the 
biometric template comprises information which is intend- 
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ed to be used for determining how the template is orient- 
ed in relation to the biometric sample. 

It is an advantage to use the public part of the 
template for this purpose since, if one knows how the 
5 template is oriented in relation to the biometric sample, 
the comparison between the biometric sample and the pri- 
vate partial area in the data carrier requires less pro- 
cessor capacity as the comparison then need not take 
place for different turning positions. Moreover, a refe- 

10 rence point is obtained for selecting the areas of the 

biometric sample that are to be sent to the data carrier 
for comparison with the private partial area or areas. 

In a preferred embodiment, the public part of the 
biometric template comprises at least one partial area, 

15 which constitutes a public partial area, of the digital 
image of the individual-specific parameter. 

In the same way as the private partial area, the 
public partial area thus is a subset of a digital image 
which represents, for instance, a fingerprint, the 

20 pattern of a person's iris or retina, a handprint or some 
other reproducible individual -specific parameter. The 
public partial area, which preferably is a single partial 
area in the centre of the fingerprint, makes it possible 
to determine the orientation of the template in relation 

25 to the sample as well as a reference point for selection 
of sample partial areas to be sent to the data carrier 
based on merely a comparison between the partial area and 
the sample in different relative positions. Such a match 
produces a reliable result. 

3 0 In a preferred embodiment of the portable data car- 

• rier, the number of private partial areas is greater than 
the number of public partial areas in the template. As a 
result, only one or a few areas need be transferred from 
the data carrier to the external processing unit . The 

3 5 comparison with the biometric sample in the external pro- 
cessing unit will therefore be quicker and at the same 
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time security increases still more since a large part of 
the template never leaves the data carrier. 

For instance, there may be a single public partial 
area which is collected from the centre of a fingerprint 
5 and a plurality, for instance four to eight, private par- 
tial areas which are placed in predetermined positions at 
a distance from the public partial area. 

In an alternative embodiment, at least one private 
partial area is located in immediate connection with a 

10 public partial area in the biometric template. This makes 
it easy to determine which partial areas of the biometric 
sample are to be transferred to the data carrier after 
the comparison of the public partial area or areas with 
the sample in the processing unit. Moreover, this partial 

15 area of the biometric sample will have been affected in 
the same manner (for example, the distance between the 
lines in a fingerprint varies with the force used by the 
individual when applying his finger to the sensor) as the 
partial area which was compared with the public part of 

2 0 the template, which results in quicker and safer identi- 
fication. 

\ As an alternative to a partial area, the public part 

of the biometric template may contain information about 
the mutual positioning of a plurality of features of 

2 5 a predetermined type in the digital image of the indivi- 
dual-specific parameter. These features can be, for exam- 
ple, line ends and line branches. The mutual positioning 
thereof can be used to determine the orientation of the 
template relative to the sample by matching the features 

30 in the public part of the template with the features in 
the sample. Preferably the public part of the template 
comprises at least five such features. The type of fea- 
tures may, but need not, be included in the public part 
of the template. Furthermore the features can be used to 

35 determine a reference point, which can correspond to, for 
example, a predetermined of the features. 
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The private partial area or areas of the template 
can be placed in the same fashion in relation to the 
public partial area for all templates. Alternatively, 
the private partial area or areas can be selected indi- 
5 vidually for each template so as to contain as much 

information of interest as possible. In the latter case, 
the public part of the biometric template further con- 
tains information about how the private partial area or 
areas are placed in relation to the reference point. 

10 The information can then be used to select in the 

external processing unit which partial areas of the 
sample are to be sent to the data carrier for comparison 
with the private partial area or areas. The information 
can be available in the form of coordinates which are 

15 related to the . reference point, for instance the centre 
in a public partial area. 

In a preferred embodiment, the portable data carrier 
further comprises at least one threshold value which 
indicates to which extent the private partial area should 

2 0 correspond to a corresponding partial area of the bio- 

metric sample for these two partial areas to be con- 
sidered to originate from the same individual. By the 
threshold value being stored in the data carrier, it may 
be set at different levels in different data carriers, so 
25 that the security requirements can be adjusted to diffe- 
rent situations. The threshold value can even be set 
individual -specifically. 

In a preferred embodiment the threshold value is 
stored in the private part of the template. 

3 0 The portable data carrier suitably comprises a com- 

munication means via which the public part of the bio- 
metric template is adapted to be transferred to the 
external processing unit. The communication means can be 
intended for wireless communication, for instance induc- 
35 tive transmission or transmission by means of radio sig- 
nals. However, it is currently preferred for the data 
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carrier to have one or more contacts for galvanic contact 
with the external processing unit . 

The portable data carrier further suitably comprises 
a signal processing means which is adapted to carry out a 
5 comparison between the private part of the template and 
at least part of the biometric sample. The signal pro- 
cessing means may comprise a suitably programmed pro- 
cessor or specifically adapted hardware, such as an ASIC 
(Application Specific Integrated Circuit) or an FPGA 

10 (Field Programmable Gate Array) . 

The portable data carrier is preferably a smart 
card. These cards can be of different standard types, 
such as Java or MULTOS cards, which are simple and inex- 
pensive types of data carrier which can easily be adapted 

15 to different applications and which are easy for a user 
to carry. A standard type smart card which contains data 
about a certain user can thus be used in a plurality of 
situations since it is precisely standardised and since 
the operating system on the card handles the files in 

20 such manner that the handling of the files is independent 
of the application in which the card is used. 

According to a second aspect, the invention relates 
to a method for biometric checking of identity in a pro- 
cessing unit. The method is characterised by the steps 

25 of receiving a biometric sample and a public part of a 
biometric template, which has a private part stored in 
a second unit and adapted to be used exclusively in the 
second unit, comparing the received public part of the 
template with the biometric sample and, when a compari- 

30 son criterion has been satisfied, transferring at least 
part of the biometric sample to the second unit for fur- 
ther comparison with the private part of the biometric 
template . 

The advantages of the method are evident from the 
35 discussion regarding the data carrier. The second unit 
can be a portable data carrier. It can also be a sta- 
tionary unit, with which the processing unit communi- 
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catee. The method is especially usable when the process- 
ing unit has poor security for carrying out the biometric 
checking of identity and when the second unit has limited 
processor capacity and/or when, for various reasons, it 
5 is desirable to limit the quantity of data to be trans- 
ferred from the processing unit to the second unit. 

The method can be implemented as a computer program 
which is executed by a processor in the processing unit. 
To this end, the invention concerns according to a third 

10 aspect a computer program product comprising program code 
which, during execution in a computer, carries out a 
method according to claims 15-22. 

According to a fourth aspect, the present invention 
relates to a processing unit for use in biometric check- 

15 ing of identity, said processing unit comprising means 
for carrying out a method according to claims 15-22. 

The means may comprise a processor with suitable 
software. It may alternatively comprise specially adapted 
hardware. The processing unit can be a suitably program- 

2 0 med general computer with means, for instance a card 
reader, which permit exchange of information with a 
second unit. It can also be a special card reader which 
has been provided with hardware and/ or software which 
enables carrying out the above-described method direct 

2 5 in the card reader. The above means suitably also com- 

prise a communication means for communication with the 
second unit . 

The comparison criterion used in the processing unit 
to determine whether parts of the biometric sample are to 

3 0 be sent to the data carrier may vary between different 

applications, depending on which security level is desir- 
able. The criterion can easily be entered in the process- 
ing unit by a person skilled in the art who is respons- 
ible for the current security system, or it can be stored 
35 in the software. 

In a preferred embodiment, the processing unit fur- 
ther comprises a sensor for recording the biometric 
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sample . That means that no extra equipment need be con- 
nected to the processing unit and the recording and the 
preprocessing, if any, can thus be integrated so that the 
procedure as from the recording of the user's biometric 
5 sample up to and including the transfer to the portable 
data carrier will be quick. Also security increases since 
the biometric sample need not be transferred between a 
special recording unit and the processing unit. Alterna- 
tively, the sensor can be located in a separate unit, 

10 from which the recorded biometric sample is transferred 
to the processing unit . 

According to a fifth aspect, the invention relates 
to a method of producing a biometric template, compris- 
ing the steps of recording a biometric sample which 

15 represents an individual -specif ic parameter; selecting 

a first part of the biometric sample; selecting a second 
part of biometric sample; storing the selected first and 
second parts in a memory in a first unit in a public and 
a private part, respectively, of a biometric template, 

2 0 the private part being adapted to be used exclusively in 
the first unit and the public part being adapted to be 
used outside the first unit. 

The first unit can be a portable data carrier, espe- 
cially a smart card. 

2 5 When producing the template, a recording of a bio- 

metric sample thus is made according to a prior-art 
method, in which the result is, for instance, a digital 
image of the current biometric sample. In this sample, 
a private and a public part are then selected. The selec- 

3 0 tion of the first and the second part means that the 

quantity of data that need be stored in the data carrier 
decreases to a considerable extent, and the advantages 
arising in consequence of this have been discussed above. 
After the parts have been selected, they are transferred 
3 5 to the data carrier and stored permanently in the memory 
thereof . » 
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According to a preferred embodiment of the above 
method, the selection of the first and the second part 
each comprises selection of at least one partial area 
of a digital image, each partial area being selected 
5 according to a predetermined public and, respectively, 
private selection criterion. 

The selection criterion can vary according to how 
safe the identification is to be made. For example, the 
public and, respectively, the private partial areas can 

10 either be selected in the same way for all individuals, 
or be selected in a unique way to each individual, where 
the areas which are of greatest interest from the view- 
point of identification are selected. However, the public 
partial area or areas are advantageously selected in such 

15 manner that they will be easy to find in the comparison 
with the biometric sample. Consequently, a quick match 
can be carried out in the processing unit. The private 
partial areas, however, can be selected according to 
other criteria since their position in the biometric 

20 sample can be related to the position of the public 

partial area and a quick match can therefore still be 
achieved. 

The method can be accomplished in specially adapt- 
ed hardware or software or in a convenient combination 

2 5 thereof. 

To that end, the invention concerns, according to 
a fifth aspect, a computer program product comprising 
program code which, during execution in a computer, car- 
ries out a method according to claims 28-34. 

3 0 According to a sixth aspect, the invention also 

relates to a method for carrying out biometric checking 
of identity, comprising the steps of recording a bio- 
metric sample which represents an individual -specif ic 
parameter; comparing in a first unit a public part of a 
3 5 biometric template, which public part has been received 

from a second unit, with the biometric sample to find out 
whether a first predetermined comparison criterion has 
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been satisfied; selecting, if the first comparison cri- 
terion has been satisfied, at least part of the biometric 
sample according to a predetermined selection criterion 
and transferring said at least part to a second unit; 
5 comparing in the second unit said at least part of the 
biometric sample with a private part, stored in the 
second unit, of the biometric template to find out 
whether a second predetermined comparison criterion has 
been satisfied. 

10 The advantages of this method will be evident from 

the discussion above. The first predetermined comparison 
criterion can be a predetermined degree of correspondence 
between the public part and the biometric sample, for 
instance a certain number of matching features or a cer- 

15 tain number of matching pixels in two overlapping partial 
areas. The second comparison criterion can be a predeter- 
mined degree of correspondence between the private part 
of the template and part of the biometric sample. This 
comparison criterion can advantageously be stored in the 

2 0 second unit, and preferably in the private part of the 
template so as not to be accessible from outside. 

The method can be accomplished in specially adapted 
hardware, in software or in a suitable combination there- 
of. To this end, the invention relates according to a 

2 5 seventh aspect to computer software comprising program 

code which, during execution in a computer, carries out 
a method according to claims 36-40. 

According to an eighth aspect, the present invention 
relates to use of a biometric template which is divided 

3 0 into a private part adapted to be exclusively used in a 

unit in which the template is stored, and a public part 
adapted to be transferred to and used in an external pro- 
cessing unit. 

As an example of use, storing in electronic form of 
35 such a template can be mentioned. 
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Brief Description of the Drawings 

The invention will now be described in more detail 
by way of an embodiment with reference to the accompany- 
ing schematic drawings. 
5 Fig. 1 is a schematic drawing illustrating a port- 

able data carrier and a processing unit according to the 
invention. 

Fig. 2 is a block diagram illustrating a method 

according to the invention of producing a biometric tem- 
10 plate with a private and a public part and storing this 

in a portable data carrier. 

Fig. 3 is a block diagram illustrating a method 

according to the invention of performing a biometric 

identity check . 
15 Figs 4a and b show two different positionings of 

private and public partial areas of a biometric sample 

for storage in the form of a template in a portable data 

carrier. 

Description of Preferred Embodiments 

20 Fig. 1 is a schematic view of a system according to 

the invention, which consists of a portable data carrier 
1 in the form of a smart card and a processing unit 2 . 
The system is intended to be used for biometric identity 
check based on fingerprints. 

25 The smart card 1 is an ordinary standard type card, 

for instance a Java or MULTOS card, and has a communica- 
tion means 3 which is adapted to communicate with the 
processing unit 2 . The communication means 3 may comprise 
one or more metal contacts which make it possible for the 

3 0 processing unit to read information on the smart card. 

The communication means 3 can alternatively comprise cir- 
cuits which enable wireless communication between the 
smart card and the processing unit, e.g. circuits for 
inductive transmission of information or for radio com- 

35 munication. The smart card 1 further has a processor 5 

and a memory 6. The memory 6 contains sensitive informa- 
tion on the one hand in the form of computer files to 
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which the person using the system wishes to gain access 
and, on the other hand, in the form of a biometric tem- 
plate which has a private part that never leaves the 
smart card and a public part that is allowed to leave the 
5 smart card. In addition to the sensitive information and 
the template, the memory 6 also comprises software which 
the processor 5 uses, for example, to compare the tem- 
plate with a biometric sample. 

The processing unit 2 can be a device which is spe- 

10 cially designed to carry out biometric identity check or 
a standard type computer which has been provided with 
suitable software and a card reader which can read the 
information on the smart card 1. The computer comprises 
a processor 7, which is used in the preprocessing of the 

15 user's biometric sample and in the comparison between 

this and the public part of the template. The processing 
unit further comprises a sensor 8 for recording a finger- 
print. The sensor can be integrated with the processing 
unit or be connected thereto as a separate unit. The 

20 sensor is preferably of a capacitive type but it can also 
be, for instance, optical, thermal or pressure- sensitive . 
The sensor 8 is connected to the processor 7 . The pro- 
cessing unit 2 further comprises a communication means 4 
which makes it possible for the processing unit to read 

25 information on the smart card 1. The communication means 
may comprise one or more metal contacts which produce 
galvanic contact with one or more metal contacts on the 
smart card or circuits for inductive transmission of 
information or for transmission by means of radio sig- 

3 0 nals. The processing unit 2 also comprises a memory 10 

in which software is stored for the preprocessing of the 
biometric sample which the processor 7 carries out. The 
memory 10 also comprises software which, for example, 
controls how the comparison between the preprocessed bio- 

35 metric sample and the public part of the biometric sample 
is to be carried out, which comparison criteria are to be 
used, and which part or parts of the biometric sample are 
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to be transferred from the computer 2 to the smart card 
1. The processing unit 2 also has circuits 11 for exter- 
nal communication with other units, such as additional 
sensors or information- carrying units. The communication 
5 between the different units in the computer 2 and on the 
smart card 1, respectively, occurs via a data bus (not 
shown) . 

Fig. 2 is a block diagram of a method of producing 
a biometric template with a private and a public part. It 

10 is here assumed that the method is carried out by means 
of a system according to Fig. 1. First, in step 20, a 
digital image in grey scale of the user's fingerprint is 
recorded by means of the sensor 8 . This image thus con- 
stitutes a digital representation of the fingerprint. 

15 The recorded image is checked so that it is ensured, 

for instance, that there is really a fingerprint in the 
image, that the fingerprint takes up a sufficiently large 
part of the image and that the fingerprint is sufficient- 
ly clear. 

2 0 It is checked, among other things, whether the user 

has applied his finger with sufficient pressure on the 
sensor 8 and so that any moisture on the user's finger 
has not made it impossible for the sensor 8 to distin- 
guish between "ridges" and "valleys" on the finger. If 

2 5 necessary, the step of recording is repeated. 

When a digital image in grey scale of sufficient 
quality has been recorded by the sensor 8, a binarisa- 
tion of the image occurs. The binarisation implies that 
the pixels of the image are compared with a grey scale 

30 threshold value. The pixels which have a value smaller 
than the grey scale threshold value are converted to 
white and those having a value greater than the grey 
scale threshold value are converted to black. The grey 
scale threshold value can be the same for the entire 

35 image or vary between different parts of the image. The 
binarisation algorithm can also be refined, so that the 
pixels are compared with the surroundings, so as to pre- 
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vent, for example, individual pixels from being white 
if all the surrounding pixels are black. Additional pre- 
processing of the image can also be carried out, such as 
change of resolution and contrast improvement. 
5 After binarisation, a partial area, below referred 

to as public partial area, of the image is selected in 
step 21 to be stored in a public part of a template. The 
area can be selected in different ways. One way is to use 
the following three quality criteria: 1) Distinctness, 

10 i.e. how easy a partial area is to binarise, 2) Unique- 
ness, i.e. how unique a partial area is, and 3) Geogra- 
phic location, i.e. where a partial area is located in 
the fingerprint . 

For instance the uniqueness can be checked by cor- 

15 relating the partial area with the surroundings and 

selecting a partial area with a small degree of correla- 
tion with the surroundings. Alternatively, it is possible 
to search out partial areas with features, i.e. points 
where a fingerprint line branches off or ends. 

2 0 As regards the geographic location, partial areas 

in the centre of the image are preferred since then there 
is a minimum risk that the partial areas are not included 
in a later recorded sample. Moreover, the image of the 
fingerprint will be least deformed in the centre when the 
25 user applies his finger with different pressures on the 
sensor. 

The partial area which best corresponds to the above 
quality criteria is selected to constitute the public 
partial area. Preferably, a single public partial area 

3 0 in the centre of the image is selected so that as little 

information as possible about the user's fingerprint is 
available in the public part of the template. However, 
a plurality of public partial areas can be selected to 
achieve safer matching of the public part of the template 
35 with the biometric sample and thus obtain safer orienta- 
tion of the template in relation to the sample. 
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When the public partial area has been selected, at 
least one, but preferably a plurality of partial areas, 
below referred to as private partial areas, are selected, 
in step 22, for storage in a private part of the template 
5 on the smart card 1. The private partial areas are pre- 
ferably selected according to the same quality criteria 
as the public partial area or areas. Preferably, six pri- 
vate partial areas are selected. More or fewer partial 
areas can be selected according to the desired security 

10 level, the desired quickness in matching and the avail- 
able processor capacity on the smart card. 

Figs 4a and 4b show examples of how public and 
private partial areas can be located in an image of a 
fingerprint. In Fig. 4a, there is a single public partial 

15 area A located in the centre and nine private partial 
areas B-J. In Fig. 4b there are seven public partial 
areas 101, 201, 301, 701 and the same number of pri- 
vate partial areas 102, 202, 302, 702. In this case, 
the private partial areas are selected so as to be posi- 

20 tioned in immediate connection with the respective public 
partial areas. 

The size of the selected public and private partial 
areas is in this embodiment 48 x 48 pixels, but can 
easily be adjusted by a person skilled in the art accord- 

25 ing to the current requirements. 

In connection with the selecting of the private par- 
tial areas, also their location in relation to a refe- 
rence point is determined. The reference point can be 
selected, for instance, to be the centre in the public 

30 partial area or in one of these if there are more. Other 
well-defined reference points, for instance by means of 
features, can of course also be selected. The locations 
of the private partial areas are indicated as coordinates 
in relation to the reference point. The coordinates are 

35 stored as part of the public part of the template. 

Before the template is transferred to the smart card 
1, a test matching is made with an additional image of 
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the user's fingerprint made by means of the sensor 8. The 
test matching is carried out according to the method that 
will be described below with reference to Fig. 3. If the 
additional image and the template match each other, the 
5 template is considered to be recordable. 

In step 23, the public and the private part of the 
template are then transferred from the processing unit 2 
via the communication circuits 3, 4 to the memory 6 of 
the smart card 1. The public part of the template will 

10 thus contain the public partial area or areas as well as 
coordinates for the location of the private partial areas 
in relation to a reference point. Its private part will 
contain the private partial areas. In the private part, 
it is also possible to store comparison criteria in the 

15 form of threshold values for which degree of matching is 
to be achieved, when matching of the private partial 
areas with sample partial areas, for the template and the 
sample to be considered to originate from the same 
individual. For example, the threshold values may 

2 0 comprise a first threshold value which indicates to what 

extent an individual private partial area is to match a 
corresponding partial area in the biometric sample. This 
first threshold value may apply to all the private 
partial areas. The threshold values may further comprise 
25 a second threshold value which indicates how many of the 
private partial areas must satisfy the first threshold 
value. They may also comprise a third threshold value for 
the extent to which the private partial areas are to 
match the corresponding sample partial areas. The 

3 0 threshold values may, but need not, apply to the public 

partial area. 

The partial areas are preferably stored in the form 
of compressed bit maps. 

When the template has been transferred, additional 
35 sensitive information can, if desired, be transferred 
from the computer 2 and stored in the memory 6 of the 
smart card 1 . The recording of a template for the card 
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holder is usually made only once. The other sensitive 
information, however, can be exchanged when necessary. 

Fig. 3 shows a method for carrying out biometric 
identity check by means of a system according to Fig. 1 
5 which comprises a smart card 1, in whose memory a tem- 
plate with a private and a public part is stored, as well 
as processing unit 2 . 

A person whose identity is to be checked first 
places his smart card 1 in a card reader which is inte- 

10 grated with or connected to the processing unit 2 . He 
then places his finger on the sensor 8 and a digital 
image in grey scale is recorded in step 3 0 in the same 
way as described above. The image, which is a digital 
representation of the person's fingerprint, can be refer- 

15 red to as a biometric sample or a fingerprint sample. The 
quality of the image is checked preferably in the same 
way as in the recording of the template and is binarised. 
Subsequently the processing unit 2 reads the public part 
of the template on the smart card 1 via the communication 

20 circuits 3, 4. 

In step 31, the public partial area included in 
the public part of the template is matched or compared 
with the binarised biometric sample. The matching can 
also be carried out with the entire sample or prefer- 

25 ably with a part of a predetermined size, for instance 
100 x 100 pixels, in the centre of the sample. In the 
matching, the public partial area "sweeps" over the sample 
image and in every position a comparison is carried out 
pixel by pixel. If a pixel in the template corresponds 

3 0 with a pixel in the sample image, a given value, for exam- 
ple 1, is added to a sum. If the pixels do not correspond, 
the sum is not increased. When the public partial area of 
the template has been swept over the entire sample image,, 
a position is obtained where the public partial area of 

35 the template best overlaps the sample image. The public 
partial area can also be rotated in relation to the 
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sample image to find out whether a better matching can 
be obtained. 

When the translation and the rotation have been made 
and the best matching position for the sample fingerprint 
5 and the public partial area of the template has been 

found, the obtained matching value is compared in step 32 
with a predetermined first comparison criterion, which in 
this case is a reference sum. If the matching value is 
smaller than the reference sum, the identity check is con- 

10 sidered to have failed, step 33, but if the matching value 
is equal to or greater than the reference sum, the process 
proceeds in step 34. 

By the matching of the public partial area of the 
template with the sample image, it has now been estab- 

15 lished how the template and the sample image are oriented 
in relation to each other. Thus, the point in the sample 
image which corresponds to the reference point in the 
template can be established. Then the coordinates in the 
public part of the template are used to determine which 

2 0 parts of the sample image are to be sent to the smart card 
to be compared with the private partial areas. More speci- 
fically, in step 34 a partial area of a predetermined size 
is selected round each point which is defined by the coor- 
dinates in the public part of the template. However, the 

2 5 sample partial areas should be slightly greater than the 

corresponding private partial areas in the template to 
compensate for any deformation of the fingerprint if the 
user's finger has been applied with a different pressure 
on the sensor when recording the sample image. These 

3 0 sample partial areas are then transferred to the smart 

card. 

The areas can be transmitted in a predetermined 
sequence so that the processor on the smart card knows 
which area is which. As a further alternative, coordi- 
3 5 nates for the positioning of the sample partial areas 
can be transmitted as well. 
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In step 35, the processor 5 on the smart card 1 com- 
pares the transmitted sample partial areas with the pri- 
vate partial areas in the private part of the template. 
This matching is much less time-consuming than if the 
5 private partial areas, for example, should be matched with 
the entire sample image since the private partial areas 
need now only be matched in a limited number of positions 
with corresponding sample partial areas. If the position 
of rotation has been established in the processing unit, 

10 no rotations need be made. For instance, the matching can 
be made in the manner described above where a number of 
points is calculated on the basis of pixel identity. When 
the transferred sample partial areas have been compared 
with the private partial areas of the template, a total 

15 matching value between 0% (i.e. no match at all) and 100% 
(i.e. complete match) is obtained. This matching value is 
compared with a second comparison criterion in the form of 
a predetermined threshold value, step 36, which can be 
stored in the private part of the template. If the match- 

2 0 ing value is equal to or greater than the threshold value, 

the identity check is considered successful, step 37, and 
the user gains access to the sensitive information stor- 
ed on the card. If the matching value is lower than the 
threshold value, the identity check is considered to have 

25 failed, step 33, and the user is refused access to the 

sensitive information. Alternatively, first the matching 
value of each individual partial area can be compared with 
a threshold value and the number of matching partial areas 
can be determined, 

30 A more comprehensive description of how partial areas 

in a fingerprint can be selected and how a template area 
can be compared with a biometric sample area is to be 
found in Applicant's International Patent Application No. 
PCT/SE99/00553. 

3 5 Although a special embodiment of the invention has 

been described above, it is obvious to those skilled in 
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the art that many alternatives, modifications and varia- 
tions are feasible in the light of the above description. 

For example, it is possible to use more than one par- 
tial area in the public part of the template. The advan- 
5 tage of this is that a safer initial identity check and 
a safer determination of how the template is oriented 
in relation to the sample image are achieved. A further 
advantage is that if a user has injured his finger so that 
the first partial area does not match, a second public 

10 partial area can possibly match. Moreover the possibi- 
lities of orienting a template in relation to a sample 
image increase if sample image is displaced in relation 
to the template. 

In the example above, the public part of the template 

15 comprises a partial area of the reference fingerprint 
image which is recorded when the template is produced. 
An alternative can be to let the public part comprise a 
description of the mutual positioning and, possibly, the 
kind of a plurality of features of a predetermined type. 

2 0 These features are transferred in the same way as the 
public partial area and matched with features in the 
sample image to establish the orientation of the template 
in relation to the sample image and, based on this orien- 
tation, a reference point which may consist of a prede- 

2 5 termined of said features and on the basis of which the 

sample partial areas to be transferred to the smart card 
can be determined. 

The public part of the template may also comprise 
other information which makes it possible to determine 

3 0 a reference point in the sample image, for instance a 

specification of a reference point on the basis of a 
relationship between line transitions or the like. 

It would also be possible to let the public part 
of the template contain merely information, for instance 
3 5 coordinates, which indicates the positioning of the pri- 
vate partial areas in relation to a reference point and 
to let the reference point be a predetermined point in 
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the actual fingerprint, i.e. not in the image, which point 
can be identified in a safe manner, PCT/SE99/00553 dis- 
closes different methods of searching out a reference 
point in a fingerprint. 
5 In the example above, it is described that the pri- 

vate partial areas are selected according to certain qua- 
lity criteria. It is, of course, possible to select these 
areas according to other criteria. It may be a variant to 
always select the areas in a predetermined position in 

10 relation to the reference point. In such a case, the pub- 
lic part of the template need not contain coordinates for 
the positioning of the private areas. 

In the example above, the template is stored in a 
portable data carrier. It could also be advantageous to 

15 use the described method in communication between a pro- 
cessing unit and a stationary data carrier, such as a 
stationary computer. Such an example could be the use of 
biometric information to verify a user's identity when he 
wants to connect to, for instance, a bank on the Internet. 

2 0 The biometric template can then be stored in a stationary 
data carrier at the bank, while the user has a fingerprint 
sensor and software to carry out that part of the above 
method that is carried out in the processing unit . The 
advantage of using the method in this application, where 

2 5 the calculating capacity of the bank does not need to con- 

stitute a problem, would be that a significantly smaller 
amount of information need be transmitted from the user 
to the bank in the verification of the user's identity. 

For instance, the areas of the image that are select - 

3 0 ed for the matching can be selected based on criteria com- 

pletely different from those described above. Completely 
different types of biometric data can also be used, such 
as the user's voice and a digital representation thereof 
in the form of a frequency spectrum, or the user's iris. 
35 Therefore the invention is considered to comprise all such 
alternatives, modifications and variations that are within 
the scope of the appended claims. 
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Finally, it should be pointed out that the above 
described comparison of a public partial area with the 
biometric sample can be carried out in many other ways 
than the calculation of number of points as described 
5 above. For example, it is possible to use multiplication 
of pixels matching each other and subsequent integration 
in order to obtain a correlation or logic XOR (exclusive 
Or) for corresponding pixels and subsequent summing up. 
The matching can also be made on non-binarised images. 



10 
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CLAIMS 

1. A portable data carrier, comprising a memory 

5 with a biometric template which is intended to be com- 
pared with a biometric sample for identity check, 
characterised in that the biometric template 
is divided into a private part which is adapted to be 
exclusively used in the portable data carrier and a 
10 public part which is adapted to be transferred to and 
used in an external processing unit. 

2. A portable data carrier as claimed in claim 1, 
wherein the private part of the biometric template com- 
prises at least one partial area, which constitutes a 

15 private partial area, of a digital image of an indivi- 
dual-specific parameter. 

3. A portable data carrier as claimed in claim 2, 
wherein the individual-specific parameter is a finger- 
print . 

2 0 4. A portable data carrier as claimed in claim 2 

or 3, wherein the public part of the biometric template 
comprises information which is intended to be used for 
determining a reference point in the biometric sample, 
which reference point corresponds to a reference point 
25 in the biometric template. 

5. A portable data carrier as claimed in claim 2, 3 
or 4, wherein the public part of the biometric template 
comprises information which is intended to be used for 
determining how the template is oriented in relation to 

30 the biometric sample. 

6. A portable data carrier as claimed in any one 
of the preceding claims, wherein the public part of the 
biometric template comprises at least one partial area, 
which constitutes a public partial area, of the digital 

3 5 image of the individual -specific parameter. 
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7. A portable data carrier as claimed in claim 6, 
wherein the number of private partial areas is greater 
than the number of public partial areas. 

8 . A portable data carrier as claimed in claim 6 or 
5 7, wherein at least one private partial area is located 

in immediate connection with a public partial area in the 
digital representation. 

9. A portable data carrier as claimed in claim 4 or 
5, wherein the public part of the biometric template com- 

10 prises information about the mutual positioning of a plu- 
rality of features of a predetermined type in the digital 
image of the individual-specific parameter. 

10. A portable data carrier as claimed in any one of 
claims 4-9, wherein the public part of the biometric tern- 

15 plate further comprises information about how said at 

least one private partial area is located in relation to 
said reference point. 

11. A portable data carrier as claimed in any one 
of claims 2-10, wherein the private part of the template 

2 0 comprises at least one threshold value which indicates 

to what extent said at least one private partial area is 
to match a corresponding partial area of the biometric 
sample for these two partial areas to be considered to 
originate from the same individual . 

25 12 . A portable data carrier as claimed in any one of 

the preceding claims, further comprising a communication 
means, via which the public part of the biometric tem- 
plate is adapted to be transferred to the external pro- 
cessing unit . 

30 13 . A portable data carrier as claimed in any one of 

the preceding claims, further comprising a signal pro- 
cessing means which is adapted to carry out a comparison 
between the private part of the template and at least 
part of the biometric sample. 

35 14 . A portable data carrier as claimed in any one of 

the preceding claims, wherein the portable data carrier 
is a smart card. 
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15. A method for biometric identity check in a pro- 
cessing unit, characterised by the steps of 

receiving a biometric sample and a public part of 
a biometric template, which has a private part that is 
5 stored in a second unit and that is adapted to be exclu- 
sively used in the second unit; 

comparing the received public part of the template 
with the biometric sample; and 

transferring, when a comparison criterion has been 
10 satisfied, at least part of the biometric sample to the 
second unit for further comparison with the private part 
of the biometric template. 

16. A method as claimed in claim 15, wherein said at 
least part of the biometric sample comprises at least one 

15 partial area in a digital image of an individual -specific 
parameter . 

17. A method as claimed in claim 15, wherein the 
public part of the biometric template comprises at least 
one partial area in -a digital image of an individual -spe- 

2 0 cific parameter. 

18. A method as claimed in claim 15, wherein the 
private part of the biometric template comprises a least 
one partial area in a digital image of an individual -spe- 
cific parameter. 

25 19. A method as claimed in claim 15, wherein the 

public part of the biometric template comprises infor- 
mation about the mutual positioning of a plurality of 
features of a predetermined type in the digital image 
of the individual -specific parameter. 

3 0 2 0. A method as claimed in any one of claims 15-19, 

further comprising the step of using the result of the 
comparison in order to determine which at least part of 
the biometric sample is to be transferred to the portable 
data carrier. 

35 21. A method as claimed in any one of claims 15-20, 

further comprising the step of determining a reference 
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point in the biometric sample by means of the public part 
of the template. 

22. A method as claimed in claim 21, wherein the 
received public part of the biometric template comprises 

5 information about how said at least part of the biometric 
sample that is transmitted to the second unit is to be 
located in relation to the reference point, and further 
comprising the step of using this information to deter- 
mine which at least part of the biometric sample is to 
10 be transferred to the portable data carrier. 

23. A method as claimed in any one of claims 15-22, 
wherein the biometric sample is a fingerprint. 

24. A computer program product comprising program 
code which, during execution in a computer, carries out 

15 a method according to claims 15-22. 

25. A processing unit for use in biometric identity 
check, characterised in that it comprises 
means for carrying out a method according to claims 
15-22 . 

20 26. A processing unit as claimed in claim 25, where- 

in said means comprise a processor and a communication 
means . 

27. A processing unit as claimed in claim 25 or 26, 
further comprising a sensor for recording the biometric 

2 5 sample, 

28. A method for producing a biometric template, 
comprising the steps of 

recording a biometric sample; 

selecting a first part in the biometric sample; 

3 0 selecting a second part in the biometric sample; 

storing the selected first and second part in a 
memory in a first unit in a public and a private part, 
respectively, of a biometric template, the private part 
being adapted to be exclusively used in the first unit 
3 5 and in the public part being adapted to be used outside 
the first unit. 
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29. A method as claimed in claim 28, wherein the 
step of selecting a first part comprises selecting at 
least one partial area, which constitutes a public par- 
tial area, in a digital image of the individual-specific 

5 parameter. 

30. A method as claimed in claim 2 8 or 29, wherein 
the step of selecting a second part comprises selecting 
at least one partial area, which constitutes a private 
partial area, in a digital image of the individual -speci- 

10 fic parameter. 

31. A method as claimed in claim 2 8 or 29, wherein 
the step of selecting a second part comprises determining 
the mutual positioning of a plurality of features of a 
predetermined type in the digital image of the indivi- 

15 dual-specific parameter, and storing information about 
this positioning in the public part of the template. 

32. A method as claimed in claim 31, further com- 
prising the steps of determining the positioning of the 
private partial area in relation to a reference point 

20 which is defined by a public part of the template, and 
storing information about the positioning in the public 
part of the template. 

33. A method as claimed in any one of claims 29-32, 
further comprising the step of storing in the first unit 

2 5 a threshold value which indicates to what extent said at 

least one private partial area is to match a correspond- 
ing partial area of the biometric sample for these two 
partial areas to be considered to originate from the same 
individual . 

3 0 34. A method as claimed in any one of the preceding 

claims, wherein the biometric sample is a digital image 
of a fingerprint . 

35. A computer program product comprises program 
code which, during execution in a computer, carries out 

35 the method according to claims 28-34. 

36. A method for carrying out biometric identity 
check, comprising the steps of 
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recording a biometric sample which represents an 
individual -specific parameter; 

comparing in a first unit a public part of a bio- 
metric template, which public part has been received from 
5 a second unit, with the biometric sample in order to find 
out whether a first predetermined comparison criterion 
has been satisfied; 

selecting, if the first comparison criterion has 
been satisfied, at least part of the biometric sample 
10 according to a predetermined private selection criterion 
and transferring said at least part to the second unit; 

comparing in the second unit said at least part 
of the biometric sample with a private part, stored in 
the second unit, of the biometric template to find out 
15 whether a second predetermined comparison criterion has 
been satisfied. 

37. A method as claimed in claim 36, wherein the 
biometric sample is recorded as a digital image of the 
individual -specific parameter. 
2 0 3 8. A method as claimed in claim 37, wherein said 

at least part of the biometric sample comprises at least 
one partial area of the digital image of the individual - 
specific parameter. 

39. A method as claimed in claim 37, wherein the 

2 5 public part of the biometric templates comprises at least 

one partial area of the digital image of the individual - 
specific parameter . 

40. A method as claimed in claim 37, wherein the 
private part of the biometric template comprises at least 

3 0 one partial area of the digital image of the individual - 

specific parameter. 

41. A computer program product comprising program 
code which, during execution in a computer, carries out 
the method according to claims 36-40. 

35 42. Use of a biometric template which is divided 

into a private part adapted to be exclusively used in a 
unit in which the template is stored and a public part 
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adapted to be transferred to and used in an external pro- 
cessing unit. 
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